CVE-2022-37680

Published: Aug 29, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An improper authentication for critical function issue in Hitachi Kokusai Electric Network products for monitoring system (Camera, Decoder and Encoder) and bellow allows attckers to remotely reboot the device via a crafted POST request to the endpoint /ptipupgrade.cgi. Security information ID hitachi-sec-2022-001 contains fixes for the issue.

Affected (1)

Products: Hitachi: Hc Ip9100hd Firmware

1 product

Hc Ip9100hd Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hitachi Hc Ip9100hd Firmware	Up to 1.07

Running on/with	Platform Versions
Hitachi Hc Ip9100hd	All versions

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (4)

https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5

Source: hirt@hitachi.co.jp

https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html

Source: hirt@hitachi.co.jp

https://gist.github.com/Nwqda/5efea18c9142c6a966d85c6be2c0c2b5

Source: af854a3a-2127-422b-91ae-364da2661108

https://www.hitachi-kokusai.co.jp/global/en/products/info/vulnerable/hitachi-sec-2022-001/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.